Software Update

Unwelcome Apple surprise

GregN

This morning while reviewing new updates on my reposado server I saw this new update:

091-76348   macOS High Sierra                           2018-04-10 []

I didn’t think much of it; various “Install macOS High Sierra” updates have appeared in the softwareupdate catalogs since early in the High Sierra beta cycle: the App Store, when installing the “Install macOS High Sierra” application, downloads resources from these catalogs. (See https://managingosx.wordpress.com/2017/09/26/some-stuff-about-install-macos-high-sierra-app/ for more info).

But then I saw this cry for help on the munki-discuss list: https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/munki-discuss/I9nA-340mO4/KVQTJMEGCgAJ

Apologies if this has been asked and answered already, but we’re in a desperate time crunch. This morning, on the second day of standardized testing for our district, High Sierra is appearing as a “regular update” instead of an App Store option, so naturally MSC offers it:

It appeared that “macOS High Sierra” was being offered as an Apple software update (which Munki was then offering to install).

Continue reading “Unwelcome Apple surprise” →

Advertisement
Unwelcome Apple surprise

Stupid Install macOS High Sierra Tricks

GregN2 Comments

While working on solving the problem of not getting a “stub” Install macOS High Sierra application, I stumbled across another way to get a full installer.

I present this merely as an oddity and a point of interest. I make no claims as to whether or not you should use this information in any way for ill or for good.

If you run a local Apple software update server, you may have noticed a new product: product ID 091-34298 — “Install macOS High Sierra”.  I use Reposado to run a local softwareupdate server:

# ./repoutil --info 091-34298
Product:       091-34298
Title:         Install macOS High Sierra
Version:       10.13
Size:          5.8 GB
Post Date:     2017-09-25 16:56:37
RestartNeeded: No
Status:        Downloaded
Location:      /disk1/swupd/html/content/downloads/04/61/091-34298
AppleCatalogs:
               https://swscan.apple.com/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
               https://swscan.apple.com/content/catalogs/others/index-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
               https://swscan.apple.com/content/catalogs/others/index-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
Branches:
               release
               testing
HTML Description:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head><title></title></head>
<body></body>
</html>

We can use the location printed above to find the actual files on disk:

# ls /disk1/swupd/html/content/downloads/04/61/091-34298/almpfkbhyxnsgbxxqhoqo7sb40w3uip0wk/
091-34298.ar.dist        091-34298.ru.dist
091-34298.ca.dist        091-34298.sk.dist
091-34298.cs.dist        091-34298.Spanish.dist
091-34298.da.dist        091-34298.sv.dist
091-34298.Dutch.dist     091-34298.th.dist
091-34298.el.dist        091-34298.tr.dist
091-34298.English.dist   091-34298.uk.dist
091-34298.es_419.dist    091-34298.vi.dist
091-34298.fi.dist        091-34298.zh_CN.dist
091-34298.French.dist    091-34298.zh_TW.dist
091-34298.German.dist    AppleDiagnostics.chunklist
091-34298.he.dist        AppleDiagnostics.dmg
091-34298.hi.dist        BaseSystem.chunklist
091-34298.hr.dist        BaseSystem.dmg
091-34298.hu.dist        InstallAssistantAuto.pkg
091-34298.id.dist        InstallAssistantAuto.pkm
091-34298.Italian.dist   InstallAssistantAuto.smd
091-34298.Japanese.dist  InstallESDDmg.chunklist
091-34298.ko.dist        InstallESDDmg.pkg
091-34298.ms.dist        InstallESDDmg.pkm
091-34298.no.dist        InstallInfo.plist
091-34298.pl.dist        OSInstall.mpkg
091-34298.pt.dist        RecoveryHDMetaDmg.pkg
091-34298.pt_PT.dist     RecoveryHDMetaDmg.pkm
091-34298.ro.dist

The contents of a softwareupdate product directory are very much like an exploded/expanded distribution package. Not very well-known is that we can sometimes trick Apple’s installer to install these. If we can get this directory copied to (or mounted via afp, smb or nfs on) a Mac (my Reposado server is on a Linux box), we can do this:

sudo installer -pkg /path/to/091-34298.English.dist -target /

or

open /path/to/091-34298.English.dist -a Installer.app

If you do the latter, you’ll need to click through the Installer like you would with any other package.

The result? A functional “Install macOS High Sierra.app” in /Applications.

Stupid Install macOS High Sierra Tricks

Some stuff about Install macOS High Sierra.app

GregN4 Comments

Now that macOS 10.13 High Sierra is out, it’s time to start taking about High Sierra stuff!

Munki 3 added support for upgrading macOS via the Install macOS.app for Sierra and High Sierra. A Munki admin need only download the installer from the App Store, and do

munkiimport /Applications/Install\ macOS\ High\ Sierra.app

to import the High Sierra installer into their Munki repo.

But there’s a wrinkle. Many people (including yours truly) were sometimes getting an installer application “stub” when downloading the Install macOS High Sierra application from the App Store. This “stub” application did not include the Contents/SharedSupport folder or its (very important) contents. The needed resources were instead downloaded “on-the-fly” when you ran the Install macOS High Sierra application.

This “stub” application is not useful as something to import into your Munki repo, or to use with AutoDMG or autonbi, or similar things. For these you really want the full installer, that is, one that contains all the needed installation resources in Contents/SharedSupport.

Many theories and ideas were put forth as to what caused one to get the stub vs the full installer. While I’m still not 100% sure about this, I think we’ve narrowed in on the cause.

It appears that when the App Store is downloading the installer app, it also uses softwareupdate to get the resources that normally reside in Contents/SharedSupport. If com.apple.SoftwareUpdate has been configured to use a CatalogURL that points to a softwareupdate catalog that does not contain product URLs for the needed Install macOS High Sierra resources, you get the “stub” application instead.

If, however, softwareupdate is using either Apple’s default CatalogURL, or is pointed to an internal CatalogURL that contains the needed products, you get the full installer.

Currently, the needed resources are Product 091-34298, “Install macOS High Sierra”, but this will almost certainly change over time.

TL;DR: to get a full High Sierra installer from the App Store, make sure softwareupdate is pointed at Apple’s softwareupdate servers or an internal server in which you have synced and made available the “Install macOS High Sierra” product.

Thanks to many people on the MacAdmins Slack for chipping in with their observations.

Some stuff about Install macOS High Sierra.app

Gatekeeper Configuration Data and XProtectPlistConfigData and Munki and Reposado, oh my!

GregN7 Comments

If you haven’t read this already, please do:

http://macops.ca/os-x-admins-your-clients-are-not-getting-background-security-updates/

I’ll wait.

Done? OK. Concerned? No? Then you can skip the rest of this post.

If you are concerned, and would like to make sure your managed machines have these security updates, I have a solution for you — if it affects you (and you use Munki and Reposado; so what, about six people?)
Continue reading “Gatekeeper Configuration Data and XProtectPlistConfigData and Munki and Reposado, oh my!” →

Gatekeeper Configuration Data and XProtectPlistConfigData and Munki and Reposado, oh my!